@kici-dev/compiler 0.1.23 → 0.1.24

package/dist/remote/local-repo-identity.js

@@ -0,0 +1,74 @@
+import "../chunk-BTugEXQM.js";
+import path from "node:path";
+import { execSync } from "node:child_process";
+import { z } from "zod";
+//#region src/remote/local-repo-identity.ts
+/** Git hosts whose origin URL we can turn into a real `owner/repo` + web link. */
+const RecognizedProvider = z.enum([
+	"github",
+	"gitlab",
+	"bitbucket"
+]);
+/** Host → provider map. The keys are the canonical public hostnames. */
+const HOST_PROVIDER = {
+	"github.com": "github",
+	"gitlab.com": "gitlab",
+	"bitbucket.org": "bitbucket"
+};
+/** The literal provider value stamped when no recognized git origin exists. */
+const LOCAL_PROVIDER = "local";
+/**
+* Parse a git remote URL into `{ provider, owner/repo }` for a recognized host.
+* Handles scp-style ssh (`git@host:owner/repo.git`), `ssh://`, and `https://`
+* forms; strips a trailing `.git`. Returns null for any unrecognized host or
+* unparseable input.
+*/
+function parseGitOrigin(url) {
+	const trimmed = url.trim();
+	const scp = /^[^@]+@([^:]+):(.+?)(?:\.git)?$/.exec(trimmed);
+	const urlStyle = /^[a-z]+:\/\/(?:[^@/]+@)?([^/]+)\/(.+?)(?:\.git)?$/.exec(trimmed);
+	const match = scp ?? urlStyle;
+	if (!match) return null;
+	const provider = HOST_PROVIDER[match[1].toLowerCase()];
+	if (!provider) return null;
+	const repoIdentifier = match[2].replace(/^\/+|\/+$/g, "");
+	if (!repoIdentifier.includes("/")) return null;
+	return {
+		provider,
+		repoIdentifier
+	};
+}
+/** Read the `origin` remote URL of the working tree at `repoRoot`, or null. */
+function detectGitOrigin(repoRoot) {
+	try {
+		return execSync("git remote get-url origin", {
+			cwd: repoRoot,
+			encoding: "utf-8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		}).trim();
+	} catch {
+		return null;
+	}
+}
+/**
+* Build the repo identity stamped on a `kici run remote` run. A recognized git
+* origin yields the real `owner/repo` + provider so the dashboard can link to
+* it; otherwise a synthetic `local/<basename>` identity with provider `local`.
+*/
+function buildLocalRepoIdentity(repoRoot) {
+	const origin = detectGitOrigin(repoRoot);
+	const parsed = origin ? parseGitOrigin(origin) : null;
+	if (parsed) return parsed;
+	return {
+		repoIdentifier: `local/${path.basename(repoRoot)}`,
+		provider: LOCAL_PROVIDER
+	};
+}
+//#endregion
+export { LOCAL_PROVIDER, RecognizedProvider, buildLocalRepoIdentity, detectGitOrigin, parseGitOrigin };
+
+//# sourceMappingURL=local-repo-identity.js.map

package/dist/remote/prod-defaults.d.ts

@@ -15,4 +15,12 @@ export declare const PROD_PLATFORM_URL = "https://api.kici.dev";
 export declare const PROD_OIDC_ISSUER = "https://auth.kici.dev/realms/kici-internal";
 /** Public OIDC client id registered for the `kici` CLI. */
 export declare const PROD_OIDC_CLIENT_ID = "kici-cli";
+/**
+ * Provenance trust root for `kici verify-attestation` when `--trust-root` is
+ * omitted: the hosted KiCI Platform's provenance issuer. The verifier appends
+ * `/.well-known/openid-configuration` and pins the token issuer to it. Pass
+ * `--trust-root` to verify against a different environment (e.g. staging) or an
+ * offline `{ issuer, jwks }` file.
+ */
+export declare const PROD_PROVENANCE_ISSUER = "https://api.kici.dev";
 //# sourceMappingURL=prod-defaults.d.ts.map

package/dist/remote/prod-defaults.js

@@ -17,7 +17,15 @@ const PROD_PLATFORM_URL = "https://api.kici.dev";
 const PROD_OIDC_ISSUER = "https://auth.kici.dev/realms/kici-internal";
 /** Public OIDC client id registered for the `kici` CLI. */
 const PROD_OIDC_CLIENT_ID = "kici-cli";
+/**
+* Provenance trust root for `kici verify-attestation` when `--trust-root` is
+* omitted: the hosted KiCI Platform's provenance issuer. The verifier appends
+* `/.well-known/openid-configuration` and pins the token issuer to it. Pass
+* `--trust-root` to verify against a different environment (e.g. staging) or an
+* offline `{ issuer, jwks }` file.
+*/
+const PROD_PROVENANCE_ISSUER = "https://api.kici.dev";
 //#endregion
-export { PROD_OIDC_CLIENT_ID, PROD_OIDC_ISSUER, PROD_PLATFORM_URL };
+export { PROD_OIDC_CLIENT_ID, PROD_OIDC_ISSUER, PROD_PLATFORM_URL, PROD_PROVENANCE_ISSUER };
 
 //# sourceMappingURL=prod-defaults.js.map

package/dist/templates/agents-md.d.ts

@@ -4,5 +4,5 @@
  * picked up by Claude Code, Cursor, Aider, and other coding agents that scan
  * the working tree for an authoring context file.
  */
-export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `matrix`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'kici:os:linux',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n   `kici:os:linux` targets any agent reporting that OS \u2014 every agent\n   self-reports `kici:os:` / `kici:arch:` / `kici:host:`. Use a custom label\n   (e.g. `'gpu'`, `'prod-pool'`) to target a specific agent pool your scaler\n   defines.\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'kici:os:linux',\n         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`node --version`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n             return { node: matrix.node };\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await $`./scripts/deploy.sh`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici test pr:open --debug`| Preview which workflows match an event.     |\n| `pnpm kici run local push`      | Execute workflows locally with no orchestrator. |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici test <event>` to preview matching.\n6. Run `kici run local <event>` to execute locally before pushing.\n";
+export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `matrix`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'kici:os:linux',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n   `kici:os:linux` targets any agent reporting that OS \u2014 every agent\n   self-reports `kici:os:` / `kici:arch:` / `kici:host:`. Use a custom label\n   (e.g. `'gpu'`, `'prod-pool'`) to target a specific agent pool your scaler\n   defines.\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'kici:os:linux',\n         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`node --version`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n             return { node: matrix.node };\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await $`./scripts/deploy.sh`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici preview pr:open --debug` | Preview which workflows match an event.   |\n| `pnpm kici run local push`      | Execute workflows locally with no orchestrator. |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici preview <event>` to preview matching.\n6. Run `kici run local <event>` to execute locally before pushing.\n";
 //# sourceMappingURL=agents-md.d.ts.map

package/dist/templates/agents-md.js

@@ -112,7 +112,7 @@ into a portable lock file, and executed by self-hosted agents.
 | Command                         | Purpose                                     |
 | ------------------------------- | ------------------------------------------- |
 | \`pnpm kici compile --check\`     | Validate workflow source without writing.   |
-| \`pnpm kici test pr:open --debug\`| Preview which workflows match an event.     |
+| \`pnpm kici preview pr:open --debug\` | Preview which workflows match an event.   |
 | \`pnpm kici run local push\`      | Execute workflows locally with no orchestrator. |
 | \`pnpm kici docs llm\`            | Print the full LLM documentation bundle.    |
 | \`pnpm kici docs llm --index\`    | Print the curated link index.               |
@@ -126,7 +126,7 @@ If \`pnpm kici\` isn't in scripts, fall back to \`npx kici\`.
    the full bundle.
 3. Edit a workflow under \`.kici/workflows/\`.
 4. Run \`kici compile --check\` (zero exit means valid).
-5. Run \`kici test <event>\` to preview matching.
+5. Run \`kici preview <event>\` to preview matching.
 6. Run \`kici run local <event>\` to execute locally before pushing.
 `;
 //#endregion

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
 import "../chunk-BTugEXQM.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.23";
+const sdkVersion = "0.1.24";
 /**
 * Generate package.json content for .kici/ directory
 *

package/dist/test-runner/step-context.d.ts

@@ -11,5 +11,5 @@ import type { StepContext, WorkflowInfo, JobInfo, MatrixValues } from '@kici-dev
 export declare function createStepContext(workflowInfo: WorkflowInfo, jobInfo: JobInfo, repoRoot: string, inputs?: Record<string, unknown>, matrix?: MatrixValues, testSecrets?: {
     flat: Record<string, string>;
     contexts: Record<string, Record<string, string>>;
-}, environment?: string, rawPayload?: Record<string, unknown>, provider?: string, dispatchInputs?: Readonly<Record<string, string | number | boolean | null>>): StepContext;
+}, environment?: string, rawPayload?: Record<string, unknown>, provider?: string, dispatchInputs?: Readonly<Record<string, string | number | boolean | null>>, signal?: AbortSignal): StepContext;
 //# sourceMappingURL=step-context.d.ts.map

package/dist/test-runner/step-context.js

@@ -42,7 +42,7 @@ function createTestLogger(jobName) {
 * `ctx.$` would inherit `process.cwd()` — i.e. wherever the user invoked
 * `kici` — which silently breaks any step that uses relative paths.
 */
-function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix, testSecrets, environment, rawPayload, provider, dispatchInputs = {}) {
+function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix, testSecrets, environment, rawPayload, provider, dispatchInputs = {}, signal = new AbortController().signal) {
 	const flat = testSecrets?.flat ?? {};
 	const namespacedSecrets = testSecrets?.contexts ?? {};
 	const mergedFlat = { ...flat };
@@ -99,6 +99,7 @@ function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix,
 	return {
 		$: scoped$,
 		log: createTestLogger(jobInfo.name),
+		signal,
 		env,
 		setEnv: (key, value) => {
 			env[key] = value;

package/dist/types.d.ts

@@ -28,7 +28,7 @@ export interface LockApproval {
     readonly when: 'always' | 'drift';
 }
 /** Schema version - re-exported from engine as single source of truth */
-export declare const SCHEMA_VERSION: 26;
+export declare const SCHEMA_VERSION: 29;
 /**
  * Source file reference with meaningful path.
  * Format: file is relative path from git root, export uses hash syntax.
@@ -275,6 +275,8 @@ export interface LockScheduleTrigger {
     readonly cronExpression: string;
     readonly timezone: string;
     readonly description?: string;
+    /** Typed schedule-input descriptors (from `schedule({ inputs })`); defaults-only. */
+    readonly inputs?: InputsDescriptorMap;
 }
 /**
  * Lifecycle trigger in lock file.
@@ -319,6 +321,8 @@ export interface LockRule {
  * Minimal representation - agents load full step functions from source.
  */
 export interface LockStep {
+    /** Discriminator for the step union; absent/`'sequential'` is an ordinary step. */
+    readonly kind?: 'sequential';
     readonly name: string;
     readonly hasOutputs: boolean;
     /** When true, job proceeds even if this step fails. */
@@ -353,6 +357,24 @@ export interface LockStep {
     /** Normalized approval gate; when set the step pauses for a human approval. */
     readonly approval?: LockApproval;
 }
+/**
+ * A concurrent group of sequential steps in the lock file. Children run
+ * concurrently behind a join barrier; the group wrapper itself consumes no
+ * flat step index (its children carry the indices). No nesting is allowed.
+ */
+export interface LockParallelStep {
+    readonly kind: 'parallel';
+    readonly name: string;
+    /** Cancel in-flight siblings when the first child fails (default true). */
+    readonly failFast: boolean;
+    /** Maximum children running at once; queued children report `pending`. */
+    readonly maxParallel?: number;
+    readonly children: readonly LockStep[];
+}
+/** A lock-file entry in a job's `steps` array: an ordinary step or a parallel group. */
+export type LockStepEntry = LockStep | LockParallelStep;
+/** Type guard distinguishing a parallel group from an ordinary lock step. */
+export declare function isLockParallelStep(entry: LockStepEntry): entry is LockParallelStep;
 /**
  * Inline expression value for pure dynamic functions.
  * The compiler serializes pure functions as { _type: 'inline', expression: '(event) => ...' }
@@ -403,7 +425,7 @@ export interface LockJob {
     readonly needs: readonly (string | LockNeedsEntry | LockNeedsGroupEntry)[];
     /** Group names this job depends on (populated from dynamicGroup refs). */
     readonly dependsOnGroups?: readonly string[];
-    readonly steps: readonly LockStep[];
+    readonly steps: readonly LockStepEntry[];
     readonly matrix?: LockMatrix;
     readonly include?: readonly Record<string, string>[];
     readonly exclude?: readonly Record<string, string>[];
@@ -418,10 +440,15 @@ export interface LockJob {
         image: string;
         env?: Record<string, string>;
     };
-    /** Deployment environment name (static string) or inline expression (pure function). */
-    readonly environment?: string | LockInlineValue;
-    /** When true, environment is dynamic (function) -- resolved at orchestrator two-phase eval or inline. */
-    readonly dynamicEnvironment?: boolean;
+    /**
+     * Deployment environments in merge order. Each entry is a static name or inline
+     * expression (pure function); `dynamic` is set when it is a function resolved at
+     * two-phase eval. Later entries override earlier ones on name collisions.
+     */
+    readonly environments?: ReadonlyArray<{
+        value: string | LockInlineValue;
+        dynamic: boolean;
+    }>;
     /** Static environment variables or inline expression (pure function). */
     readonly env?: Record<string, string> | LockInlineValue;
     /** When true, env is dynamic (function) -- resolved at orchestrator two-phase eval or inline. */

package/dist/types.js

@@ -17,6 +17,10 @@ import { SCHEMA_VERSION as SCHEMA_VERSION$1 } from "@kici-dev/engine";
 */
 /** Schema version - re-exported from engine as single source of truth */
 const SCHEMA_VERSION = SCHEMA_VERSION$1;
+/** Type guard distinguishing a parallel group from an ordinary lock step. */
+function isLockParallelStep(entry) {
+	return entry.kind === "parallel";
+}
 /** Type guard for inline expression values */
 function isLockInlineValue(value) {
 	return typeof value === "object" && value !== null && value._type === "inline";
@@ -30,6 +34,6 @@ function isLockDynamicJobFn(job) {
 	return job._type === "dynamic";
 }
 //#endregion
-export { SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob };
+export { SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob };
 
 //# sourceMappingURL=types.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "ci",
@@ -30,9 +30,6 @@
     "access": "public"
   },
   "type": "module",
-  "bin": {
-    "kici": "./dist/cli.js"
-  },
   "files": [
     "dist",
     "!dist/**/*.map",
@@ -63,11 +60,11 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.23",
-    "@kici-dev/engine": "0.1.23"
+    "@kici-dev/core": "0.1.24",
+    "@kici-dev/engine": "0.1.24"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.1.23"
+    "@kici-dev/sdk": "0.1.24"
   },
   "devDependencies": {
     "@types/proper-lockfile": "^4.1.4"

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/compiler@0.1.23",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.23/d56984d9-446e-4527-842c-a90a4a7c9a78",
+  "name": "@kici-dev/compiler@0.1.24",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.24/5972016c-419a-4b37-a318-6beead684099",
   "creationInfo": {
-    "created": "2026-06-25T11:12:53Z",
+    "created": "2026-06-28T16:24:34Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -484,7 +484,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/compiler",
-      "versionInfo": "0.1.23",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -495,16 +495,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.23"
+          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.24"
         }
       ],
       "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.24",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.23",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -515,16 +515,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.23"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.24"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.23",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -535,16 +535,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.23"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.24"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.23",
+      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.24",
       "name": "@kici-dev/sdk",
-      "versionInfo": "0.1.23",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -555,7 +555,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.23"
+          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.24"
         }
       ],
       "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
@@ -3222,17 +3222,17 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.23",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -3301,82 +3301,82 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.23",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.24",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.23",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.24",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-micromatch-4.0.8",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },